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REMARKS 

Claims 1-22 are pending in the application, of which Claims 1 and 12 are independent. 
Claims have been rejected on the ground of nonstatutory obviousness-type double patenting, 
under 35 U.S.C. 1 12, second paragraph, under 35 U.S.C. 102(e), and under 35 U.S.C. 103(a). 
Those rejections are respectfully traversed. Reconsideration is requested. 

Statement of Substance of Interview 

Applicants thank Examiners Murdough and Fischer for a helpful telephonic interview on 
September 8, 2008 with Applicants' attomey. During the interview, the participants discussed 
independent Claims 1 and 12 and cited reference Carter et al Applicants attomey presented 
differences between the claims and the cited reference. Examiner Fischer then suggested 
amendments to help clarify the claimed invention. The above amendments are believed to 
implement those suggestions, thus, clearly reciting the claimed invention and distinguishing from 
the cited art. Support for the amendments can be found in Applicants' specification on at least 
page 9, lines 1-21 and page 12, lines 22-30. 

Suggested Amendments Regarding Functional Claim Language 

On page 1 1 of the Office Action and during the interview, the Office stated that 
functional claim language in an apparatus claim need not be given patentable weight, and cited 
section 21 14 of the MPEP in support of that assertion. 

Applicants respectfully note that section 2114 states that "features of an apparatus may be 
recited either structurally or functionally" and refers to the case of In re Schreiber, 128 F.3d 
1473 (Fed. Cir. 1997), where it was determined that the functionally recited limitations at issue 
were inherent in the prior art reference. If the functional limitations were considered to be 
inherent in the prior art reference, then it follows that the court considered the functional 
limitations in determining patentability. 

Applicants also respectfully note that section 2173.05(g) of the MPEP states that "[a] 
functional limitation is an attempt to define something by what it does, rather than by what it is" 
and that "[t]here is nothing inherently wrong with defining some part of an invention in 
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functional terms." Section 2173.05(g) further states that "[a] functional limitation must be 
evaluated and considered, just like any other limitation of the claim, for what it fairly conveys to 
a person of ordinary skill in the pertinent art in the context in which it is used" and provides the 
following example of an acceptable functional claim element that complies with 35 U.S.C. 1 12, 
second paragraph: 

In a claim that was directed to a kit of component parts capable of being 
assembled, the Court held that limitations such as "members adapted to be 
positioned" and "portions . . . being resiliently dilatable whereby said housing 
may be slidably positioned" serve to precisely define present structural 
attributes of interrelated component parts of the claimed assembly. 

As such, Applicants respectfully submit that functional language in an apparatus or system claim 

can be given patentable weight and that the language of the above system claims, as now recited, 

is believed to clearly define and sufficiently describe the structure of the claimed invention. For 

example, system Claim 12 now recites that its structural components are "configured" in a 

particular way, much like the above example. 

Objection to the Specification 

The specification has been objected to as failing to provide proper antecedent basis for 
the term "IRP intercept," as recited in Claims 4 and 15; however, interception of an I/O Request 
Packet (IRP) is described in the specification on at least page 9, lines 12-16 and page 13, lines 
14-23. As described, such a packet may be intercepted in an operation system kernel and 
examined by the claimed process or system. Thus, the specification is believed to provide proper 
antecedent basis for the term "IRP intercept." As such. Applicants respectfully request 
withdrawal of the objection to the specification. 

Objections to the Claims 

Claims 13-22 have been objected to for being directed toward apparatuses and being 
dependent on a claim directed toward a system. Accordingly, Claims 13-22 are being amended 
to be directed toward systems. As such. Applicants respectfully request withdrawal of the 
objections to Claims 13-22. 
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Reicctions Under 35 U.S.C, 1 12, Second Paragraph 

Claims 4 and 15 have been rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
Applicant regards as the invention. In particular, the Office asserts that the term "IRP intercept" 
is indefinite. As presented above, interception of an I/O Request Packet (IRP) is described in the 
specification on at least page 9, lines 12-16 and page 13, lines 14-23. As such, the term "IRP 
intercept" is not believed to be indefinite. Applicants respectfully request withdrawal of the 
rejections of Claims 4 and 15 imder 35 U.S.C. 1 12, second paragraph. 

Rejections Under 35 U.S.C. 102(e) 

Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 have been rejected under 35 U.S.C. 
102(e) as being anticipated by Carter et al (U.S. Pub. No. 2003/0051026, hereinafter "Carter"). 

Brief Review of Claimed Process and System 

Before addressing the rejections, a brief review of the Applicants' disclosure may be 
helpful without limiting the claims. The Applicants' disclosure is directed to a process and a 
system for establishing usage control over digital assets, such as computer files. The process and 
system track access to files by authorized users (i.e., users already having access to the digital 
assets) and their passage of such files to uncontrollable destinations, such as removable storage 
media or network connections. Such a passage of digital assets by authorized users may indicate 
a possible abuse of trusted authorized access rights. 

With reference to Figs. 2 and 3, an agent process 300 runs within an operating system 
kernel within a client 102 in a network. The agent process 300 includes sensors 500 that detect 
and track atomic events 350, such as file, printing, clipboard, and I/O device operations. The 
agent 300 reports the atomic events 350 to an activity joumaling process typically running on an 
activity joumaling server 104-2, which processes the atomic event data 350 and combines the 
data into what are called aggregate events 360. Each aggregate event 360 is composed of one or 
more atomic events 350 that conform to some predetermined pattern of behavior indicative of an 
activity that should be monitored. Policy violation predicates 370, 585, which define 
enforcement policies, are then asserted when an aggregate event 360 matching a policy violation 
is detected. 
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Brief Review of Cited Art 

Turning to the cited reference, Carter presents a Network Surveillance and Security 
System (NSSS) for providing computer network security. The NSSS monitors all 
communications traffic in a local network for unauthorized access attempts. Methods for 
accomplishing this include determining if a particular communication originated from an 
authorized source. Based on the determination, the NSSS determines if the communication is 
permitted. If the access attempt is unauthorized, the NSSS may respond with a countermeasure, 
such as deactivating the port at which the unauthorized access communication was received. 
Overall, the system of Carter determines if an attempt to access a system is authorized or 
unauthorized. (See Carter, paragraphs [0194-0222] and Abstract.) 

Carter is Not Concerned with Controlling Actions of Authorized Users 
In contrast to the system of Carter, users of the claimed process and system are already 
authorized users and already have access to digital assets within the network. Because the users 
already have access to the digital assets, the claimed process and system are, instead, concemed 
with the authorized users' usage of the digital assets, such as saving a file containing sensitive 
information to a compact disk, which can then be distributed to unauthorized persons. Because 
Carter is not concemed with the actions of authorized users, Applicants respectfully submit that 
Carter does not teach or suggest sensing atomic events from within an operating system kernel 
of a user client device, the atomic events being low level kernel events and being sensed upon 
actions relatin£ to authorized access to a digital asset bv the end user of the user client device, " 
as claimed in Claim 1 and as similarly claimed in Claim 12. 

The Office asserts that the list of observed network operations listed after paragraph 
[0787] of Carter discloses atomic level digital asset access events that are sensed by the system 
of Carter. The Office fiirther asserts that Carter discloses that those events are sensed at a point 
of authorized access because Carter discloses a switch that is controlled by Carter's NSSS. The 
operations listed after paragraph [0787] of Carter, however, are concemed with attempted access 
violations and failures, that is, unauthorized access by a user. If these events are sensed at the 
switch controlled by Carter's NSSS, the switch would be considered to be a point of 
unauthorized access with respect to those events, because the user attempting to gain access to 
the system is unauthorized. 
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Carter's System Does Not Sense Events Within a Kernel of a Client Device 
Even if Carter was concerned with the actions of authorized users, Applicants 
respectfully submit that Carter does not teach or suggest that atomic level digital asset access 
events are sensed ''from within an operating system kernel of a user client device, " as claimed in 
Claims 1 and as similarly claimed in Claim 12, for at least two reasons. First, the NSSS does not 
sense events at an end user client device, and second, the NSSS does not sense events within a 
kernel of an operating system of that device. 

As presented above, the Office asserts that the events of Carter are sensed at a switch 
controlled by Carter's NSSS {see Carter, reference numeral 18 of Fig. 1). The Office also asserts 
that a workstation of Carter's Fig. 1 discloses the claimed end user client device. If Carter's 
NSSS senses events at the switch of Fig. K then the NSSS does not sense events at a workstation 
of Fig. 1. 

Further, the Office asserts that paragraph [0147] of Carter discloses that the sensing step 
of the NSSS is located within an operation system kernel; however, paragraph [0147] only 
provides a common definition for an operating system kemel. Neither the cited paragraph nor 
the remainder of Carter teaches that the events of Carter are sensed within an operating system 
kemel. In contrast, Carter suggests that the NSSS is not part of an operating system kemel, 
because Carter discloses that the NSSS has a priority that is higher than that of a kemel {see 
Carter, paragraphs [0588] and [0589]) and that the NSSS may be in communication with and 
pass messages to the kemel (see Carter, paragraphs [093 1] and [0936]), thus, suggesting that the 
NSSS and the kemel are separated. 

Because Carter does not sense events at a kemel of an operating system of an end user 
client device, Carter does not teach or suggest '' sensing atomic events from within an operating 
system kernel of a user client device, the atomic events being low level kernel events and being 
sensed upon actions relating to authorized access to a digital asset by the end user of the user 
client device, " as claimed in Claim 1 and as similarly claimed in Claim 12. As such, Applicants 
respectfully submit that Claims 1 and 12 are novel and nonobvious over the cited art. 

Dependent Claims 2-5, 7, 8, 10, 1 1, 13, 15, 16, 18, 19, 21, and 22 depend from 
independent Claims 1 or 12 and include the elements of Claims 1 or 12 presented above as being 
novel and nonobvious over the cited art. Therefore, Applicants respectfully submit that these 
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dependent claims are novel and nonobvious over the cited art for at least the same reasons as 
presented above for independent Claims 1 and 12. 

As such, the rejections of Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 under 35 
U.S.C. 102(e) are believed to be overcome. Applicants respectfully request withdrawal of those 
rejections. 

Rejections Under 35 U.S.C. 103(a) 

Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 have been altematively rejected under 
35 U.S.C. 103(a) as being unpatentable by Carter in view of Danieli. 

Claims 6, 17, and 20 have been rejected under 35 U.S.C. 103(a) as being unpatentable 
over Carter in view of Admitted Prior Art. 

Claim 9 has been rejected under 35 U.S.C. 103(a) as being unpatentable over Carter in 
view of Danieli (U.S. Patent No. 6,510,513). 

Even if Danieli was combined with Carter for the purpose of teaching the use of a digital 
asset outside of a security perimeter, as explained by the Office, the combination would not cure 
the deficiencies of Carter presented above with respect to independent Claims 1 and 12. 
Therefore, Applicants respectfully submit that Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 
are novel and nonobvious over such a combination of Carter and Danieli. As such, the 
alternative rejections of Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 under 35 U.S.C. 
103(a) are believed to be overcome. Applicants respectfully request withdrawal of those 
rejections. 

Dependent Claims 6, 9, 17, and 20 depend from independent Claims 1 or 12 and include 
the elements of Claims 1 or 12 presented above as being novel and nonobvious over the cited art. 
Therefore, Applicants respectfully submit that those dependent claims are novel and nonobvious 
over the cited art for at least the same reasons as presented above for independent Claims 1 and 
12. As such, the rejections of Claims 6, 9, 17, and 20 under 35 U.S.C. 103(a) are believed to be 
overcome. Applicants respectfully request withdrawal of those rejections. 
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Double Patenting Rejections 

Claims 1-22 have been rejected on the ground of nonstatutory obviousness-type double 
patenting as being unpatentable over Claims 1-16 of U.S. Patent No. 7,100,047. A Terminal 
Disclaimer with respect to U.S. Patent No. 7,100,047 is being submitted concurrently herewith, 
together with the requisite fee, to obviate these rejections. 



In view of the above amendments and remarks, it is believed that all claims are in 
condition for allowance, and it is respectfully requested that the application be passed to issue. If 
the Examiner feels that a telephone conference would expedite prosecution of this case, the 
Examiner is invited to call the undersigned. 



CONCLUSION 



Respectfully submitted, 



HAMILTON, BROOK, SMITH & REYNOLDS, P.C. 



By /^^l^.^^^^^ 

Pa^ck A. Quinfan 
Registration No. 61,287 
Telephone: (978)341-0036 
Facsimile: (978)341-0136 




Concord, MA 01742-9133 




